Validate value of Referrer-Policy (instead of just existance)

[baknu]

See recommended values in test explanation.

[baknu]

Certain values are also required by DigiD since May 2020. See: "Update van de testaanpak DigiD-assessment 2.0" (https://www.norea.nl/download/?id=7851).

*Referrer-Policy*

Te configureren waarden: Gebruik de instelling ‘same-origin’, zodat de referrer-header alleen wordt meegestuurd bij verzoeken binnen het eigen domein. Dit voorkomt het lekken van privacygevoelige informatie bij omleiden naar externe domeinen. De striktere instelling ‘no-referrer’ kan ook worden gebruikt, zodat de referrer-header nooit wordt meegestuurd.

[baknu]

This should be implmented in a similar way as the "Validate CSP directives #325" change.

We need the following:

1. Validate Referrer-Policy values and check for no-referrer or same-origin that we consider good. Other values are considered as bad. Reference to relevant code: https://github.com/NLnetLabs/Internet.nl/blob/master/checks/tasks/http_headers.py#L605
2. The 'bad' verdict text (detail/web/appsecpriv/http-csp/verdict/bad_en.md) will be change into: "Your web server does not offer Referrer-Policy, or does offer Referrer-Policy with certain insecure and/or privacy-unfriendly settings."
3. Scoring (scoring.py) will not change. In case of bad (i.e. failing the test) we keep providing a warning (STATUS_NOTICE) which has no impact on %-score.

[sinteur]

Pull request #516 - but it still needs a nice text in the translation files with a short explananation